fix: Support corporate TLS for Anthropic (NODE_EXTRA_CA_CERTS)

[petre]

Summary

OpenAnt’s Python code calls Anthropic over HTTPS. On networks with TLS inspection (e.g. Zscaler), the proxy uses a certificate chain signed by a corporate CA that is not in the default trust store. Node and Claude Code commonly work because operators set NODE_EXTRA_CA_CERTS to a PEM file containing that CA. This PR makes the Anthropic Python client honor the same variable and documents it in the root README.

Changes

• libs/openant-core/utilities/anthropic_http.py (new): Builds an httpx client for the Anthropic SDK using the Mozilla CA bundle via certifi, then loads NODE_EXTRA_CA_CERTS so trust matches “public CAs + corporate root”.
• Python 3.13+: Clears VERIFY_X509_STRICT when using the extra PEM so corporate intercept CAs that omit critical Basic Constraints still verify (avoids false failures vs typical Node behavior).
• Call sites: Anthropic construction goes through create_anthropic_client() so all LLM paths share the same TLS behavior.
• core/analyzer.py: Fix NameError: define tracker via get_global_tracker() before add_prior_usage when restoring checkpoint usage.
• core/scanner.py: Report failures log the full exception chain (underlying SSL/connection errors), not only Anthropic’s generic “Connection error.”
• libs/openant-core/pyproject.toml: Declare certifi explicitly (imported for the trust bundle).
• README.md: Short NODE_EXTRA_CA_CERTS note for users behind HTTPS inspection.

How to test

Using the openant CLI (typical): configure a key with openant set-api-key …, or pass openant scan --api-key '…'.
Behind TLS inspection: also export NODE_EXTRA_CA_CERTS=/path/to/corporate-root.pem (same PEM many teams use for Node / Claude Code).